Binance Executive Warns After $6.3 Billion Hack
Teng points to social engineering, internal AI tools, and EIP-7702 as attack surfaces. Binance says it has replenished 98% of the affected assets and is working with law enforcement.
Key Takeaways
- Binance co-CEO Richard Teng says the crypto industry should learn from the $6.3 billion hack at Binance.
- The attack started with a fake development tool, followed by fake job interviews and abuse of internal AI tools and wallet authorization.
- Binance has replenished 98% of the affected assets and is working with law enforcement to trace and freeze stolen funds.
Binance co-CEO Richard Teng says the crypto industry should learn from the hack of $6.3 billion (€5.6 billion) at Binance. According to him, the incident shows how new crypto tools, internal systems, and social engineering can combine into a major risk.
How the Attack Unfolded
Teng told CNBC on Tuesday that Binance published a detailed report so the industry could learn from it. He also pointed to an FBI attribution to North Korea and to a campaign that was built up over months.
According to him, the attack started in June with a fake development tool. In September, fake job interviews followed. After that, the attackers used internal AI tools to get access to the system that authorized wallet transactions.
On October 29, they used a new Ethereum feature while Binance had already paused withdrawals. On Ethereum, it involved one wallet that lost about 167,464 ETH and $1.6 billion (€1.4 billion) in Tether.
Debate Over EIP-7702
Researchers link the attack to EIP-7702, an Ethereum upgrade from May 2025 that lets regular wallets borrow smart contract code. An Ethereum researcher said the feature itself is not broken, but ETH holders on exchanges may still be exposed through custodians' signing systems.
Security firm Blockaid said the attacker bundled 50 signed authorizations into one transaction. Binance only revoked that delegation almost four hours later, according to a detailed reconstruction.
That debate matters for European crypto users, because it shows that new features in wallets and exchanges do not just add new options, they can also open up new attack surfaces. For platforms that hold customer funds, the setup of the signing process remains an important part of security. The fallout from the attack is still visible too: Binance has now used part of its SAFU reserve to absorb the damage.
Binance Recovers the Losses
Binance says it has now replenished 98% of the affected assets. The company has also rebuilt the wallet system, replaced devices, and revoked linked login credentials.
The crypto company is also working with law enforcement and industry peers to trace and freeze stolen funds. Teng said an independent review should determine whether the problem was mainly in the signer's security or in the new feature itself.